CVE-2025-21762

What it actually does

Potential use-after-free in arp_xmit() when invoked without RTNL or RCU read-side critical section, allowing access to freed memory structures.

Why it matters to the business

Local attackers may escalate privileges or trigger kernel crashes on Linux systems, leading to service disruption and unauthorized access risks across many deployments.

How an attack unfolds

An attacker with local access triggers ARP transmission paths that call arp_xmit without synchronization, dereferencing freed objects to achieve code execution or denial of service.

How to fix it

Apply kernel updates addressing the RCU protection in arp_xmit; for ebookmeta (PyPI) upgrade to version 1.2.8.

How to confirm the fix worked

Verify updated kernel sources contain RCU read lock around arp_xmit calls and test ARP operations under concurrent load for absence of UAF reports.

Typical attack path

1. Obtain local user access on affected Linux host
2. Craft conditions to invoke arp_xmit without RCU/RTNL
3. Exploit freed memory for privilege escalation or crash

How to detect it

Inspect kernel logs and crash dumps for use-after-free signatures involving arp_xmit or ARP-related functions; correlate with local user activity around network stack events.

What your security team should do

• Prioritize patching Linux kernels on all exposed systems given 608 days since publication
• Monitor for local privilege escalation attempts
• Review dependent packages including ebookmeta for the listed 1.2.8 fix